The seminar will investigate the role of the international law of State responsibility and computer science in the context of the malicious, internationally unlawful cyber operations between States. It will explain why States resort to such an activity, which compliance-inducing mechanisms are offered to the injured States by the international law and which of them are in fact viable considering the limitations of computer science and the stringent legal standards of attribution.

Cyber insurance risk is the risk that insurance companies assume by underwriting insurance policies with underlying exposure to cyber incidents. This presentation will expand on the cyber insurance market in the UK, and the types of cyber insurance risk. It will also set out the Bank of England’s expectations from insurers for the prudent management of cyber insurance risk.

Cybercrime now operates like a business. Its goods and services may be illicit, but it is highly organized, complex, driven by profit, and globally interconnected. This talk examines the underground economy and how it works. In particular, it seeks to make sense of the strategies cybercriminals use to build a thriving industry in a low-trust environment characterized by a precarious combination of anonymity and teamwork. It is based on 7 years of fieldwork in cybercrime hotspots around the world, including in Russia, Ukraine, Romania, Brazil, Nigeria, China and the USA. The core source of data is interviews with almost 250 law enforcement agents, security professionals and former cybercriminals. This study has just been published in book form by Harvard University Press.

Security is a top priority at Amazon Web Services. In the shared responsibility model with customers, AWS manages the components from the operating system down to the physical security of the facilities; AWS customers are responsible for securing applications they build on top of it. In this talk I will describe tools that support our customers in securing their applications, and tools that we use to secure the infrastructure. This work is part of AWS' Provable Security initiative, where we use automated reasoning to increase the security assurance of the cloud infrastructure and the applications built on top of it.

The UK Department for Digital, Culture, Media & Sport (DCMS) has developed, in cooperation with industry, consumer associations and academia, the Code of Practice for Consumer IoT Security. It brings together, in thirteen outcome-focused guidelines, what is widely considered good practice in IoT security. Its aim is to support all parties involved in the development, manufacturing and retail of consumer IoT to ensure that products are secure by design. Launched in October 2018, it puts the UK head and shoulders above the rest of the world for leadership in IoT security. David Rogers explains the background to the Code of Practice, what the guidelines mean from a technology perspective and what will come next.

The project “The Prosecution Service in favor of Digital Education in Schools” developed by the Federal Prosecution Service in partnership with the NGO SaferNet Brazil, aims to provide, through education, children and adolescents with awareness about their rights and duties in the use of the Internet, in order to make them grow concious about the risks at virtual environment, knowing how to protect themselves from being victims of crimes commited via Internet. The second scope is to prevent them from being future aggressors making clear that legal rules apply alike to the virtual environment and the real one. Explaining how the project's archetype emerged and how it developed in the prosecution environment has the goal to encourage simple and innovative ideas within the Institution, which, besides being a criminal prosecution service, is concerned with crime prevention, including cybercrimes.

This talk will cover: Imagination in science fiction gives us our view of the next war We have to stop fighting the old one The history of cyberwar starting with the Victorian telegraph Elizebeth Friedman and the first crypto wars The 1990s and encryption exports Fake news and other manipulation Deep fakes and information war of the future Who’s fighting this damn thing?  

In the era of the mobile apps and IoT, huge quantities of data about individuals and their activities offer a wave of opportunities for economic and societal value creation. However, the current personal data ecosystem is fragmented and inefficient. On one hand, end-users are not able to control access (either technologically, by policy, or psychologically) to their personal data (currently only possible for GDPR regulated countries) which results in issues related to privacy, personal data ownership, transparency, and value distribution. On the other hand, this puts the burden of managing and protecting user data on apps and ad-driven entities (e.g., an ad-network) at a cost of trust and regulatory accountability. In such a context, data holders (e.g., apps) may take advantage of the individuals’ inability to fully comprehend and anticipate the potential uses of their private information with detrimental effects for aggregate social welfare (e.g., Facebook-Cambridge Analytica, and Gmail case studies). In this talk, we investigate the problem of the existence and computationally efficient engineering design of efficient market ecosystems (and their subsequent implications to law and policy) that aim to achieve a maximum social welfare state among competing data holders by preserving the heterogeneous privacy preservation constraints up to certain compromise levels, induced by their clients, and at the same time satisfying requirements of agencies (e.g., advertising organizations) that collect and trade client data for the purpose of targeted advertising, assuming the potential practical inevitability of some amount inappropriate data leakage on behalf of the data holders.

Many individuals are concerned about the governance of machine learning systems and the prevention of algorithmic harms. The EU’s recent General Data Protection Regulation (GDPR) has been seen as a core tool for achieving better governance of this area. While the GDPR does apply to the use of models in some limited situations, most of its provisions relate to the governance of personal data, while models have traditionally been seen as intellectual property. We present recent work from the information security literature around ‘model inversion’ and ‘membership inference’ attacks, which indicates that the process of turning training data into machine-learned systems is not one way, and demonstrate how this could lead some models to be legally classified as personal data. Taking this as a probing experiment, we explore the different rights and obligations this would trigger and their utility, and posit future directions for algorithmic governance and regulation. from Veale M, Binns R, Edwards L. forthcoming. Algorithms that remember: Model inversion attacks and data protection law. Phil. Trans. R. Soc. A 376: 20180083. (preprint: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3212755)